7 ms·

I'm sorry for the trouble you're having. I have on idea of what's happened and why but thought it timely to point out for the benefit of those reading this thre

by cletus 14y ago

I'm sorry for the trouble you're having. I have on idea of what's happened and why but thought it timely to point out for the benefit of those reading this thread: I highly suggest you use two-factor authentication with GMail: http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... Or Jeff Atwood's post on this: http://www.codinghorror.com/blog/2012/04/make-your-email-hacker-proof.html http://www.codinghorror.com/blog/2012/04/make-your-email-hac... Your email is too valuable to be left open to attack, hijacking or theft.

patio11 14y ago
cough If any Googlers are reading this, Google often phrases error messages more like that quote ("Us us us us us us, ergo, you don't get what you need") instead of like cletus did ("You you you, you you you, ergo, we're going to take this action on your behalf".). Dale Carnegie, Cletus, and every sane copywriter on the planet strongly suggest rewriting that prompt and related ones. After taking baby steps like sounding like one cares more major interventions like actually caring may be called for. (I enormously respect the Googlers who I know that that line will discomfit but this is criticism that you guys have gone out of your way for years to earn.)
- deleted 14y ago
  [deleted]
- deleted 14y ago
  [deleted]
OzzyB 14y ago
Really? It is now a suggested policy to use additional authorization flows in order to use this email service? Are we talking about the same email service? You know, the one that's supposed to be so awesome that you'll quickly forget about getting your email the "old fashioned way" by having to mess with those pesky things like setting up a POP/IMAP account on your host provider? Talk about things coming full circle. [Addendum} No, haven't had my email hacked. I guess I was a little blow-hardy, thanks for responses :)
- joezydeco 14y ago
  gmail is a large high-visibility target. I, for one, appreciate the fact that 2FA is available with the service. Everyone should have it turned on for any high-value mail account they own, Google or no-Google.
  - packetslave 14y ago
    Take a look at, for example, "Abuse at Scale" from the Gmail folks at April's RIPE conference for an idea of the threat. https://ripe64.ripe.net/presentations/48-AbuseAtScale.pdf https://ripe64.ripe.net/presentations/48-AbuseAtScale.pdf 1 million+ bogus authentication attempts per day, 60-100k auths per second (legit and not), etc.
    - joezydeco 14y ago
      That's definitely an eyeopener. Gracias.
- duaneb 14y ago
  Well, ideally, 2factor should be used for anything with sensitive information... Frankly, I wish I could have enabled 2factor waaaaay earlier on GMail.
- laconian 14y ago
  I take it you've never had your email account hacked, then?
gergles 14y ago
I am, of course, already using 2FA, but I completely agree that everyone should have it set up.
- dclowd9901 14y ago
  If this is true, why is cletus bringing it up?
dredmorbius 14y ago
Google's got enough of my info. If they want to come up with a two-factor auth, I'm happy to provide the public half of a PKI keypair. Of my choosing. Not my phone number, thanks. My real email is too valuable to be left to GMail.
- gkop 14y ago
  You can get a list of 1-time pads instead.
  - joevandyk 14y ago
    To setup 2 factor auth, you have to give them a phone number that you can receive a call or sms on, I believe.
    - vivekkrish 14y ago
      Which is why I provide my Google Voice number for this purpose. Works perfectly!
    - archivator 14y ago
      I'm pretty sure that's just for recovery. The actual setup involves scanning a QR code in the Authenticator app, which is the seed for the TOTP - http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al...
      - jakobe 14y ago
        Yes, but they show you that QR code only AFTER you gave them your phone number and typed in the confirmation code.
- mehta 14y ago
  I know it is not a perfect solution but there is an Authenticator app that you can use on Android. I believe that iOS might have one too but I am not sure. This solution does not require you to give them your phone number :).
Duff 14y ago
I think that the root of this issue is the stupid Google policy of not distinguishing any variation of your address if a '.' character is in there -- until someone registers it. People get confused and try to login. So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com! I was an early beta GMail user have a reasonably common first initial last name GMail address. I probably get 3-5 password reset attempts per month. I also routinely received a variety of interesting misdirected emails. Everything from someone's VPN credentials, a US military EEOC complaint, invitations to a stag party in Ireland, a video of a paratransit bus flipping over (intended to be sent to an investigator), to girls modelling underwear for boyfriends.
- clebio 14y ago
  Really, that works (surprise, not incredulity)? I have a period in my gmail address, but have never tried that. Seems like a very strange default.
- FaceKicker 14y ago
  > So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com! Uh, if this is true it's a security abomination. I'm pretty sure Gmail doesn't allow registration with a login that would be considered the same as an already registered one (but I'm too lazy to check a few to confirm, just because I refuse to believe Google could be that dumb).
  - km3k 14y ago
    I just tried logging in with a random '.' in my username and got in.
    - FaceKicker 14y ago
      That doesn't actually contradict what the guy I responded to said though; you'd want to try signing up for gmail with a few variations of your own login that have a few random extra '.'s. My assumption is that these would all be rejected due to the fact that the canonicalized version (all lowercase and with all periods removed) matches the canonicalized version of a currently registered login, but this guy was saying that's not the case. But anyway, paul responded so it's a moot point.
scromar 14y ago
My wife has had two-factor authentication for at least a year, she only accesses gmail from her iPod touch and the browser on her laptop, and she had this happen to her about a month ago. No recourse. It came back eventually, but apparently two-factor auth is not sufficient to prevent this issue.
oneilse14 14y ago
And for all things not Google, check out http://www.duosecurity.com/ http://www.duosecurity.com/. Completely painless to set up on my box at home.
- clebio 14y ago
  Wow, I've wanted such a thing for a while, but hadn't gotten around to researching. Thanks for this!
DavidAbrams 14y ago
Or hey, get a real host, domain, and E-mail account. In other news: Someone else's blog is under my Blogger account, and there's absolutely no way to contact Google about it. The new credo of doing business is HIDE FROM THE CUSTOMER. It's disgraceful.
- mvelie 14y ago
  If you're not paying them you're not the customer.
  - DavidAbrams 14y ago
    As several have pointed out: You are paying.
donniezazen 14y ago
Their is no excuse for not using two-factor authentication with all Google products.
- BHSPitMonkey 14y ago
  Not that it's a very strong excuse, but it -can- be fairly annoying if the prompt appears and your phone is dead (or not nearby, or lost).
  - jcmhn 14y ago
    That's why as part of setting up 2F they suggest you generate and print a list of backup verification codes. 2F wouldn't even be an option if they didn't provide an emergency out.
nicksergeant 14y ago
I'd love to do this, but my Apps account gives me no such opportunity to setup 2FA, following those instructions: http://cl.ly/242v451j3g331U393u34 http://cl.ly/242v451j3g331U393u34
- esalman 14y ago
  Apps account administrator should enable 2FA for the domain. I have this option in all of my Apps administrator panel.
  - nicksergeant 14y ago
    Ahh, thanks!
ebiester 14y ago
And hope your phone isn't stolen, losing access to your email? That's why I've always avoided two factor authentication -- it's scary enough losing your phone, but then you're locked out of your email as well? (Perhaps coloring my perception is that I have a pay-as-you-go phone currently.)

by cletus 14y ago

patio11 14y ago

cough If any Googlers are reading this, Google often phrases error messages more like that quote ("Us us us us us us, ergo, you don't get what you need") instead of like cletus did ("You you you, you you you, ergo, we're going to take this action on your behalf".). Dale Carnegie, Cletus, and every sane copywriter on the planet strongly suggest rewriting that prompt and related ones. After taking baby steps like sounding like one cares more major interventions like actually caring may be called for. (I enormously respect the Googlers who I know that that line will discomfit but this is criticism that you guys have gone out of your way for years to earn.)

deleted 14y ago
[deleted]
deleted 14y ago
[deleted]

OzzyB 14y ago

Really? It is now a suggested policy to use additional authorization flows in order to use this email service? Are we talking about the same email service? You know, the one that's supposed to be so awesome that you'll quickly forget about getting your email the "old fashioned way" by having to mess with those pesky things like setting up a POP/IMAP account on your host provider? Talk about things coming full circle. [Addendum} No, haven't had my email hacked. I guess I was a little blow-hardy, thanks for responses :)

joezydeco 14y ago
gmail is a large high-visibility target. I, for one, appreciate the fact that 2FA is available with the service. Everyone should have it turned on for any high-value mail account they own, Google or no-Google.
- packetslave 14y ago
  Take a look at, for example, "Abuse at Scale" from the Gmail folks at April's RIPE conference for an idea of the threat. https://ripe64.ripe.net/presentations/48-AbuseAtScale.pdf https://ripe64.ripe.net/presentations/48-AbuseAtScale.pdf 1 million+ bogus authentication attempts per day, 60-100k auths per second (legit and not), etc.
  - joezydeco 14y ago
    That's definitely an eyeopener. Gracias.
duaneb 14y ago
Well, ideally, 2factor should be used for anything with sensitive information... Frankly, I wish I could have enabled 2factor waaaaay earlier on GMail.
laconian 14y ago
I take it you've never had your email account hacked, then?

gergles 14y ago

I am, of course, already using 2FA, but I completely agree that everyone should have it set up.

dclowd9901 14y ago
If this is true, why is cletus bringing it up?

dredmorbius 14y ago

Google's got enough of my info. If they want to come up with a two-factor auth, I'm happy to provide the public half of a PKI keypair. Of my choosing. Not my phone number, thanks. My real email is too valuable to be left to GMail.

gkop 14y ago
You can get a list of 1-time pads instead.
- joevandyk 14y ago
  To setup 2 factor auth, you have to give them a phone number that you can receive a call or sms on, I believe.
  - vivekkrish 14y ago
    Which is why I provide my Google Voice number for this purpose. Works perfectly!
  - archivator 14y ago
    I'm pretty sure that's just for recovery. The actual setup involves scanning a QR code in the Authenticator app, which is the seed for the TOTP - http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al...
    - jakobe 14y ago
      Yes, but they show you that QR code only AFTER you gave them your phone number and typed in the confirmation code.
mehta 14y ago
I know it is not a perfect solution but there is an Authenticator app that you can use on Android. I believe that iOS might have one too but I am not sure. This solution does not require you to give them your phone number :).

Duff 14y ago

I think that the root of this issue is the stupid Google policy of not distinguishing any variation of your address if a '.' character is in there -- until someone registers it. People get confused and try to login. So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com! I was an early beta GMail user have a reasonably common first initial last name GMail address. I probably get 3-5 password reset attempts per month. I also routinely received a variety of interesting misdirected emails. Everything from someone's VPN credentials, a US military EEOC complaint, invitations to a stag party in Ireland, a video of a paratransit bus flipping over (intended to be sent to an investigator), to girls modelling underwear for boyfriends.

clebio 14y ago
Really, that works (surprise, not incredulity)? I have a period in my gmail address, but have never tried that. Seems like a very strange default.
FaceKicker 14y ago
> So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com! Uh, if this is true it's a security abomination. I'm pretty sure Gmail doesn't allow registration with a login that would be considered the same as an already registered one (but I'm too lazy to check a few to confirm, just because I refuse to believe Google could be that dumb).
- km3k 14y ago
  I just tried logging in with a random '.' in my username and got in.
  - FaceKicker 14y ago
    That doesn't actually contradict what the guy I responded to said though; you'd want to try signing up for gmail with a few variations of your own login that have a few random extra '.'s. My assumption is that these would all be rejected due to the fact that the canonicalized version (all lowercase and with all periods removed) matches the canonicalized version of a currently registered login, but this guy was saying that's not the case. But anyway, paul responded so it's a moot point.

scromar 14y ago

My wife has had two-factor authentication for at least a year, she only accesses gmail from her iPod touch and the browser on her laptop, and she had this happen to her about a month ago. No recourse. It came back eventually, but apparently two-factor auth is not sufficient to prevent this issue.

oneilse14 14y ago

And for all things not Google, check out http://www.duosecurity.com/ http://www.duosecurity.com/. Completely painless to set up on my box at home.

clebio 14y ago
Wow, I've wanted such a thing for a while, but hadn't gotten around to researching. Thanks for this!

DavidAbrams 14y ago

Or hey, get a real host, domain, and E-mail account. In other news: Someone else's blog is under my Blogger account, and there's absolutely no way to contact Google about it. The new credo of doing business is HIDE FROM THE CUSTOMER. It's disgraceful.

mvelie 14y ago
If you're not paying them you're not the customer.
- DavidAbrams 14y ago
  As several have pointed out: You are paying.

donniezazen 14y ago

Their is no excuse for not using two-factor authentication with all Google products.

BHSPitMonkey 14y ago
Not that it's a very strong excuse, but it -can- be fairly annoying if the prompt appears and your phone is dead (or not nearby, or lost).
- jcmhn 14y ago
  That's why as part of setting up 2F they suggest you generate and print a list of backup verification codes. 2F wouldn't even be an option if they didn't provide an emergency out.

nicksergeant 14y ago

I'd love to do this, but my Apps account gives me no such opportunity to setup 2FA, following those instructions: http://cl.ly/242v451j3g331U393u34 http://cl.ly/242v451j3g331U393u34

esalman 14y ago
Apps account administrator should enable 2FA for the domain. I have this option in all of my Apps administrator panel.
- nicksergeant 14y ago
  Ahh, thanks!

ebiester 14y ago

And hope your phone isn't stolen, losing access to your email? That's why I've always avoided two factor authentication -- it's scary enough losing your phone, but then you're locked out of your email as well? (Perhaps coloring my perception is that I have a pay-as-you-go phone currently.)